-
Notifications
You must be signed in to change notification settings - Fork 8.1k
Description
Description
I think that if someone tries to use keycloak-authz-client together with private_key_jwt authentication ( JWTClientCredentialsProviders) and the algorithm ECDSA, it will probably fail with the exception like Not able to load any cryptoProvider with the classLoader: ... .
For our keycloak-client testsuite, we have workaround to implement DummyCryptoProvider in the testsuite - https://github.com/keycloak/keycloak-client/pull/56/files . But I think this may not work for user's applications unless they implement the DummyCryptoProvider themselves in their application or they include keycloak-core (together with keycloak-crypto-default and bouncycastle) to their classpath, which is not good.
Possible solutions:
-
Update the code of
keycloak-authz-clientto not rely onCryptoIntegration. Maybe something similar like was done for SAML adapter in those commits:
dad4477
125124c
I think we can also moveClientCredentialsProvider(or only some implementations likeJWTClientCredentialsProvider) directly tokeycloak-authz-client-testsas this code is not needed inside Keycloak server at all. With the adapter, thekeycloak-authz-clientis the only component, which needsClientCredentialsProviderAFAIK. Then we can updateJWTClientCredentialsProvidermore easily to use the code not relying onCryptoIntegration, but rather snippets currently used byDummyCryptoProviderfrom the PR https://github.com/keycloak/keycloak-client/pull/56/files . -
Have
DummyCryptoProviderdirectly inkeycloak-authz-client. But I think this option may be problematic as in keycloak testsuite, there are bothkeycloak-crypto-defaultandkeycloak-authz-client-testson classpath, which can mean multiple crypto providers causing further issues -
Some other option?
### Tasks
- [ ] https://github.com/keycloak/keycloak/issues/33831
- [ ] https://github.com/keycloak/keycloak-client/issues/82